Merge commit '84d74ae9c9cbed73274b8e4e00be14688ffc93fe'

12 files changed, 454 insertions, 58 deletions

diff --git a/nixpkgs/pkgs/servers/dns/bind/default.nix b/nixpkgs/pkgs/servers/dns/bind/default.nix
index 2aae5634cc5e..2afc5da51f57 100644
--- a/nixpkgs/pkgs/servers/dns/bind/default.nix
+++ b/nixpkgs/pkgs/servers/dns/bind/default.nix
@@ -1,8 +1,8 @@
 { config, stdenv, lib, fetchurl, fetchpatch
-, perl
-, libcap, libtool, libxml2, openssl
+, perl, pkg-config
+, libcap, libtool, libxml2, openssl, libuv
 , enablePython ? config.bind.enablePython or false, python3 ? null
-, enableSeccomp ? false, libseccomp ? null, buildPackages
+, enableSeccomp ? false, libseccomp ? null, buildPackages, nixosTests
 }:
 
 assert enableSeccomp -> libseccomp != null;
@@ -10,11 +10,11 @@ assert enablePython -> python3 != null;
 
 stdenv.mkDerivation rec {
   pname = "bind";
-  version = "9.14.12";
+  version = "9.16.7";
 
   src = fetchurl {
-    url = "https://ftp.isc.org/isc/bind9/${version}/${pname}-${version}.tar.gz";
-    sha256 = "1j7ldvdschmvzxrbajjhmdsl2iqxc1lm64vk0a5sdykxpy9y8kcw";
+    url = "https://downloads.isc.org/isc/bind9/${version}/${pname}-${version}.tar.xz";
+    sha256 = "1l8lhgnkj3fnl1101bs3pzj5gv2x5m9ahvrbyscsc9mxxc91hzcz";
   };
 
   outputs = [ "out" "lib" "dev" "man" "dnsutils" "host" ];
@@ -24,8 +24,8 @@ stdenv.mkDerivation rec {
     ./remove-mkdir-var.patch
   ];
 
-  nativeBuildInputs = [ perl ];
-  buildInputs = [ libtool libxml2 openssl ]
+  nativeBuildInputs = [ perl pkg-config ];
+  buildInputs = [ libtool libxml2 openssl libuv ]
     ++ lib.optional stdenv.isLinux libcap
     ++ lib.optional enableSeccomp libseccomp
     ++ lib.optional enablePython (python3.withPackages (ps: with ps; [ ply ]));
@@ -35,8 +35,6 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--localstatedir=/var"
     "--with-libtool"
-    "--with-libxml2=${libxml2.dev}"
-    "--with-openssl=${openssl.dev}"
     (if enablePython then "--with-python" else "--without-python")
     "--without-atf"
     "--without-dlopen"
@@ -59,7 +57,6 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     moveToOutput bin/bind9-config $dev
-    moveToOutput bin/isc-config.sh $dev
 
     moveToOutput bin/host $host
 
@@ -68,13 +65,15 @@ stdenv.mkDerivation rec {
     moveToOutput bin/nslookup $dnsutils
     moveToOutput bin/nsupdate $dnsutils
 
-    for f in "$lib/lib/"*.la "$dev/bin/"{isc-config.sh,bind*-config}; do
+    for f in "$lib/lib/"*.la "$dev/bin/"bind*-config; do
       sed -i "$f" -e 's|-L${openssl.dev}|-L${openssl.out}|g'
     done
   '';
 
   doCheck = false; # requires root and the net
 
+  passthru.tests = { inherit (nixosTests) bind; };
+
   meta = with stdenv.lib; {
     homepage = "https://www.isc.org/downloads/bind/";
     description = "Domain name server";
diff --git a/nixpkgs/pkgs/servers/dns/bind/dont-keep-configure-flags.patch b/nixpkgs/pkgs/servers/dns/bind/dont-keep-configure-flags.patch
index 17fdb15ad460..ceb887e678eb 100644
--- a/nixpkgs/pkgs/servers/dns/bind/dont-keep-configure-flags.patch
+++ b/nixpkgs/pkgs/servers/dns/bind/dont-keep-configure-flags.patch
@@ -1,40 +1,37 @@
-diff --git a/bin/named/include/named/globals.h b/bin/named/include/named/globals.h
-index b8e356b..cbe6c94 100644
---- a/bin/named/include/named/globals.h
-+++ b/bin/named/include/named/globals.h
-@@ -68,7 +68,9 @@ EXTERN const char *		named_g_version		INIT(VERSION);
- EXTERN const char *		named_g_product		INIT(PRODUCT);
- EXTERN const char *		named_g_description	INIT(DESCRIPTION);
- EXTERN const char *		named_g_srcid		INIT(SRCID);
+diff -ru a/bin/named/include/named/globals.h b/bin/named/include/named/globals.h
+--- a/bin/named/include/named/globals.h	2020-09-24 17:43:49.398977491 +0200
++++ b/bin/named/include/named/globals.h	2020-09-24 17:44:36.826590553 +0200
+@@ -69,7 +69,9 @@
+ EXTERN const char *named_g_product     INIT(PRODUCT);
+ EXTERN const char *named_g_description INIT(DESCRIPTION);
+ EXTERN const char *named_g_srcid       INIT(SRCID);
 +#if 0
- EXTERN const char *		named_g_configargs	INIT(CONFIGARGS);
+ EXTERN const char *named_g_configargs  INIT(CONFIGARGS);
 +#endif
- EXTERN const char *		named_g_builder		INIT(BUILDER);
- EXTERN in_port_t		named_g_port		INIT(0);
- EXTERN isc_dscp_t		named_g_dscp		INIT(-1);
-diff --git a/bin/named/main.c b/bin/named/main.c
-index 62d9ce3..342abdc 100644
---- a/bin/named/main.c
-+++ b/bin/named/main.c
-@@ -459,8 +459,10 @@ printversion(bool verbose) {
+ EXTERN const char *named_g_builder     INIT(BUILDER);
+ EXTERN in_port_t named_g_port	       INIT(0);
+ EXTERN isc_dscp_t named_g_dscp	       INIT(-1);
+diff -ru a/bin/named/main.c b/bin/named/main.c
+--- a/bin/named/main.c	2020-09-24 17:43:49.399977504 +0200
++++ b/bin/named/main.c	2020-09-24 17:44:24.102426273 +0200
+@@ -506,7 +506,9 @@
  	}
  
  	printf("running on %s\n", named_os_uname());
 +#if 0
- 	printf("built by %s with %s\n",
- 	       named_g_builder, named_g_configargs);
+ 	printf("built by %s with %s\n", named_g_builder, named_g_configargs);
 +#endif
  #ifdef __clang__
  	printf("compiled by CLANG %s\n", __VERSION__);
- #else
-@@ -1001,9 +1003,11 @@ setup(void) {
- 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
- 		      "running on %s", named_os_uname());
+ #else /* ifdef __clang__ */
+@@ -1102,9 +1104,11 @@
+ 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE, "running on %s",
+ 		      named_os_uname());
  
 +#if 0
  	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
- 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
- 		      "built with %s", named_g_configargs);
+ 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE, "built with %s",
+ 		      named_g_configargs);
 +#endif
  
  	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
diff --git a/nixpkgs/pkgs/servers/dns/coredns/default.nix b/nixpkgs/pkgs/servers/dns/coredns/default.nix
index 598f5bedc2bf..981056b53c1c 100644
--- a/nixpkgs/pkgs/servers/dns/coredns/default.nix
+++ b/nixpkgs/pkgs/servers/dns/coredns/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "coredns";
-  version = "1.6.9";
-
-  goPackagePath = "github.com/coredns/coredns";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "coredns";
     repo = "coredns";
     rev = "v${version}";
-    sha256 = "18c02ss0sxxg8lkhdmyaac2x5alfxsizf6jqhck8bqkf6hiyv5hc";
+    sha256 = "1wayfr26gwgdl0sfrvskb4hkxfmxfy7idbrpw3z4r05fkr2886xj";
   };
 
-  vendorSha256 = "0ykhqsz4a7bkkxcg7w23jl3qs36law1f8l1b5r3i26qlamibqxl7";
+  vendorSha256 = "17znl3vkg73hnrfl697rw201nsd5sijgalnbkljk1b4m0a01zik1";
+
+  doCheck = false;
 
   meta = with stdenv.lib; {
     homepage = "https://coredns.io";
@@ -21,4 +21,4 @@ buildGoModule rec {
     license = licenses.asl20;
     maintainers = with maintainers; [ rushmorem rtreffer deltaevo ];
   };
-}
\ No newline at end of file
+}
diff --git a/nixpkgs/pkgs/servers/dns/dnsdist/default.nix b/nixpkgs/pkgs/servers/dns/dnsdist/default.nix
index 0c236fe93155..98947bd1873c 100644
--- a/nixpkgs/pkgs/servers/dns/dnsdist/default.nix
+++ b/nixpkgs/pkgs/servers/dns/dnsdist/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "dnsdist";
-  version = "1.4.0";
+  version = "1.5.0";
 
   src = fetchurl {
     url = "https://downloads.powerdns.com/releases/dnsdist-${version}.tar.bz2";
-    sha256 = "1h0x5xd13j8xxrrinb7d55851m6n9w0r15wx9m3c50dk7qngldm3";
+    sha256 = "0n3vy84kczvbwbzmr1d2c9lh3im77gz83wczj0im4zs91kpw81rc";
   };
 
   nativeBuildInputs = [ pkgconfig protobuf ];
diff --git a/nixpkgs/pkgs/servers/dns/knot-dns/default.nix b/nixpkgs/pkgs/servers/dns/knot-dns/default.nix
index 3dc6fd3e2c73..3ebb31e20f24 100644
--- a/nixpkgs/pkgs/servers/dns/knot-dns/default.nix
+++ b/nixpkgs/pkgs/servers/dns/knot-dns/default.nix
@@ -1,18 +1,17 @@
 { stdenv, fetchurl, pkgconfig, gnutls, liburcu, lmdb, libcap_ng, libidn2, libunistring
-, systemd, nettle, libedit, zlib, libiconv, libintl
+, systemd, nettle, libedit, zlib, libiconv, libintl, libmaxminddb, libbpf, nghttp2
 , autoreconfHook
 }:
 
 let inherit (stdenv.lib) optional optionals; in
 
-# Note: ATM only the libraries have been tested in nixpkgs.
 stdenv.mkDerivation rec {
   pname = "knot-dns";
-  version = "2.9.5";
+  version = "3.0.0";
 
   src = fetchurl {
     url = "https://secure.nic.cz/files/knot-dns/knot-${version}.tar.xz";
-    sha256 = "1109a8ba212ff8ddfdbaf44a6f8fc13a2b880a98a9e54c19112ba72a1aacbf76";
+    sha256 = "f1c96aff6e873a2f9b1b8c2441d5a7801dd48d3abdb738a4d24b26c2a8fbe6c4";
   };
 
   outputs = [ "bin" "out" "dev" ];
@@ -27,6 +26,7 @@ stdenv.mkDerivation rec {
     # Don't try to create directories like /var/lib/knot at build time.
     # They are later created from NixOS itself.
     ./dont-create-run-time-dirs.patch
+    ./runtime-deps.patch
   ];
 
   nativeBuildInputs = [ pkgconfig autoreconfHook ];
@@ -34,9 +34,15 @@ stdenv.mkDerivation rec {
     gnutls liburcu libidn2 libunistring
     nettle libedit
     libiconv lmdb libintl
+    nghttp2 # DoH support in kdig
+    libmaxminddb # optional for geoip module (it's tiny)
     # without sphinx &al. for developer documentation
+    # TODO: add dnstap support?
   ]
-    ++ optionals stdenv.isLinux [ libcap_ng systemd ]
+    ++ optionals stdenv.isLinux [
+      libcap_ng systemd
+      libbpf # XDP support
+    ]
     ++ optional stdenv.isDarwin zlib; # perhaps due to gnutls
 
   enableParallelBuilding = true;
diff --git a/nixpkgs/pkgs/servers/dns/knot-dns/runtime-deps.patch b/nixpkgs/pkgs/servers/dns/knot-dns/runtime-deps.patch
new file mode 100644
index 000000000000..19fc9cd07b18
--- /dev/null
+++ b/nixpkgs/pkgs/servers/dns/knot-dns/runtime-deps.patch
@@ -0,0 +1,14 @@
+Remove unnecessary runtime dependencies.
+
+`knotc status configure` shows summary from the configure script,
+but that contains also references like include paths.
+Filter these at least in a crude way (whole lines).
+--- a/configure.ac
++++ b/configure.ac
+@@ -766,5 +766,5 @@ result_msg_base="  Knot DNS $VERSION
+ 
+-result_msg_esc=$(echo -n "$result_msg_base" | sed '$!s/$/\\n/' | tr -d '\n')
++result_msg_esc=$(echo -n "$result_msg_base" | grep -Fv "$NIX_STORE" | sed '$!s/$/\\n/' | tr -d '\n')
+ 
+ AC_DEFINE_UNQUOTED([CONFIGURE_SUMMARY],["$result_msg_esc"],[Configure summary])
+ 
diff --git a/nixpkgs/pkgs/servers/dns/knot-resolver/default.nix b/nixpkgs/pkgs/servers/dns/knot-resolver/default.nix
index f596934a4298..9f54d2f5fa30 100644
--- a/nixpkgs/pkgs/servers/dns/knot-resolver/default.nix
+++ b/nixpkgs/pkgs/servers/dns/knot-resolver/default.nix
@@ -16,11 +16,11 @@ lua = luajitPackages;
 
 unwrapped = stdenv.mkDerivation rec {
   pname = "knot-resolver";
-  version = "5.1.1";
+  version = "5.1.3";
 
   src = fetchurl {
     url = "https://secure.nic.cz/files/knot-resolver/${pname}-${version}.tar.xz";
-    sha256 = "f72214046df8aae2b1a5c6d1ad0bc8b166aa060df5b008f6e88b4f6ba79cbf4e";
+    sha256 = "20cd829027e39a9f7d993894e3640e886825b492d9ac1a744ac5616cc101458b";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/nixpkgs/pkgs/servers/dns/ncdns/default.nix b/nixpkgs/pkgs/servers/dns/ncdns/default.nix
new file mode 100644
index 000000000000..f1d124176bb4
--- /dev/null
+++ b/nixpkgs/pkgs/servers/dns/ncdns/default.nix
@@ -0,0 +1,40 @@
+{ lib, nixosTests, git, buildGoPackage, fetchFromGitHub, libcap }:
+
+buildGoPackage rec {
+  pname = "ncdns";
+  version = "0.0.10.3";
+
+  goPackagePath = "github.com/namecoin/ncdns";
+  goDeps = ./deps.nix;
+
+  src = fetchFromGitHub {
+    owner = "namecoin";
+    repo = "ncdns";
+    rev = "v${version}";
+    sha256 = "12q5al48mkjhgyk7z5wyklzzrdbcqhwxl79axa4gh9ld75prghbq";
+  };
+
+  patches = [ ./fix-tpl-path.patch ];
+
+  buildInputs = [ libcap ];
+
+  preBuild = ''
+    go generate github.com/namecoin/x509-signature-splice/...
+  '';
+
+  postInstall = ''
+    mkdir -p "$out/share"
+    cp -r "$src/_doc" "$out/share/doc"
+    cp -r "$src/_tpl" "$out/share/tpl"
+  '';
+
+  meta = with lib; {
+    description = "Namecoin to DNS bridge daemon";
+    homepage = "https://github.com/namecoin/ncdns";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ rnhmjoj ];
+  };
+
+  passthru.tests.ncdns = nixosTests.ncdns;
+
+}
diff --git a/nixpkgs/pkgs/servers/dns/ncdns/deps.nix b/nixpkgs/pkgs/servers/dns/ncdns/deps.nix
new file mode 100644
index 000000000000..7ac3f2897e02
--- /dev/null
+++ b/nixpkgs/pkgs/servers/dns/ncdns/deps.nix
@@ -0,0 +1,309 @@
+# This file was generated by https://github.com/kamilchm/go2nix v1.3.0
+[
+  {
+    goPackagePath = "github.com/BurntSushi/toml";
+    fetch = {
+      type = "git";
+      url = "https://github.com/BurntSushi/toml";
+      rev = "3012a1dbe2e4bd1391d42b32f0577cb7bbc7f005";
+      sha256 = "1fjdwwfzyzllgiwydknf1pwjvy49qxfsczqx5gz3y0izs7as99j6";
+    };
+  }
+  {
+    goPackagePath = "github.com/alecthomas/template";
+    fetch = {
+      type = "git";
+      url = "https://github.com/alecthomas/template";
+      rev = "fb15b899a75114aa79cc930e33c46b577cc664b1";
+      sha256 = "1vlasv4dgycydh5wx6jdcvz40zdv90zz1h7836z7lhsi2ymvii26";
+    };
+  }
+  {
+    goPackagePath = "github.com/alecthomas/units";
+    fetch = {
+      type = "git";
+      url = "https://github.com/alecthomas/units";
+      rev = "f65c72e2690dc4b403c8bd637baf4611cd4c069b";
+      sha256 = "04jyqm7m3m01ppfy1f9xk4qvrwvs78q9zml6llyf2b3v5k6b2bbc";
+    };
+  }
+  {
+    goPackagePath = "github.com/btcsuite/btcd";
+    fetch = {
+      type = "git";
+      url = "https://github.com/btcsuite/btcd";
+      rev = "9f0179fd2c46caba343b6515602cf37172f14d5f";
+      sha256 = "0cvpjsxlyzm04pwzi7nj43k9h5wfxj07jdc49qxsav5323v1nvka";
+    };
+  }
+  {
+    goPackagePath = "github.com/btcsuite/btclog";
+    fetch = {
+      type = "git";
+      url = "https://github.com/btcsuite/btclog";
+      rev = "84c8d2346e9fc8c7b947e243b9c24e6df9fd206a";
+      sha256 = "02dl46wcnfpg9sqvg0ipipkpnd7lrf4fnvb9zy56jqa7mfcwc7wk";
+    };
+  }
+  {
+    goPackagePath = "github.com/btcsuite/btcutil";
+    fetch = {
+      type = "git";
+      url = "https://github.com/btcsuite/btcutil";
+      rev = "b2bf7f89d674a3702182b7e15f52807896051af3";
+      sha256 = "0wwykb4cbq8xj2mls2mxma5vaahdgdy3vqw1r2fi4wyj0yr4kyw9";
+    };
+  }
+  {
+    goPackagePath = "github.com/btcsuite/go-socks";
+    fetch = {
+      type = "git";
+      url = "https://github.com/btcsuite/go-socks";
+      rev = "4720035b7bfd2a9bb130b1c184f8bbe41b6f0d0f";
+      sha256 = "18cv2icj059lq4s99p6yh91hlas5f2gi3f1p4c10sjgwrs933d7b";
+    };
+  }
+  {
+    goPackagePath = "github.com/btcsuite/websocket";
+    fetch = {
+      type = "git";
+      url = "https://github.com/btcsuite/websocket";
+      rev = "31079b6807923eb23992c421b114992b95131b55";
+      sha256 = "0xpkf257ml6fpfdgv7hxxc41n0d5yxxm3njm50qpzp7j71l9cjwa";
+    };
+  }
+  {
+    goPackagePath = "github.com/coreos/go-systemd";
+    fetch = {
+      type = "git";
+      url = "https://github.com/coreos/go-systemd";
+      rev = "b51e752dd1c9c618846f8bc5b95ab524bd7b11c2";
+      sha256 = "127dj1iwp69yj74nwh9ckgc0mkk1mv4yzbxmbdxix1r7j6q35z3j";
+    };
+  }
+  {
+    goPackagePath = "github.com/golang/groupcache";
+    fetch = {
+      type = "git";
+      url = "https://github.com/golang/groupcache";
+      rev = "8c9f03a8e57eb486e42badaed3fb287da51807ba";
+      sha256 = "0vjjr79r32icjzlb05wn02k59av7jx0rn1jijml8r4whlg7dnkfh";
+    };
+  }
+  {
+    goPackagePath = "github.com/hlandau/buildinfo";
+    fetch = {
+      type = "git";
+      url = "https://github.com/hlandau/buildinfo";
+      rev = "337a29b5499734e584d4630ce535af64c5fe7813";
+      sha256 = "1kq3r1i4rr9bcvj5yg8w1l95f6sfc3kn6kgcdmlh5i3j9w2sram8";
+    };
+  }
+  {
+    goPackagePath = "github.com/hlandau/degoutils";
+    fetch = {
+      type = "git";
+      url = "https://github.com/hlandau/degoutils";
+      rev = "8fa2440b63444dad556d76366f1c3ee070c8a577";
+      sha256 = "1yj39jbrk3xx3cyl8f4asakc74lsl0brasi25xjf6219pg69q0iy";
+    };
+  }
+  {
+    goPackagePath = "github.com/hlandau/dexlogconfig";
+    fetch = {
+      type = "git";
+      url = "https://github.com/hlandau/dexlogconfig";
+      rev = "244f29bd260884993b176cd14ef2f7631f6f3c18";
+      sha256 = "1d01ghx6xawj3nk3lpk51wbbpxdnc9vzvijvlayvp7cxgsacslbc";
+    };
+  }
+  {
+    goPackagePath = "github.com/hlandau/xlog";
+    fetch = {
+      type = "git";
+      url = "https://github.com/hlandau/xlog";
+      rev = "197ef798aed28e08ed3e176e678fda81be993a31";
+      sha256 = "08rjlqnjbfgpz5rbjq89l7y5vyhk99ivr928sqdi5gnqznbqs4m8";
+    };
+  }
+  {
+    goPackagePath = "github.com/kr/pretty";
+    fetch = {
+      type = "git";
+      url = "https://github.com/kr/pretty";
+      rev = "4e0886370c3a67530192c6a238cff68f56c141b0";
+      sha256 = "1ywbfzz1h3a3qd8rpkiqwi1dm4w8ls9ijb4x1b7567grns9f0vnp";
+    };
+  }
+  {
+    goPackagePath = "github.com/kr/text";
+    fetch = {
+      type = "git";
+      url = "https://github.com/kr/text";
+      rev = "702c74938df48b97370179f33ce2107bd7ff3b3e";
+      sha256 = "0hf58ypz6rxsw6nx3i856whir9lvy4sdx946wbw1nfaf2rdmr9vx";
+    };
+  }
+  {
+    goPackagePath = "github.com/mattn/go-isatty";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mattn/go-isatty";
+      rev = "cb30d6282491c185f77d9bec5d25de1bb61a06bc";
+      sha256 = "0v59mv94acd2m72q8adhigxkx1vn38l5h0d8hp0nxga2v9f3v8kd";
+    };
+  }
+  {
+    goPackagePath = "github.com/miekg/dns";
+    fetch = {
+      type = "git";
+      url = "https://github.com/miekg/dns";
+      rev = "203ad2480beb9330454efc215d21f16c607e8174";
+      sha256 = "12i2l79whv7a8c27f1dvq4wqikx4d0l30r1ja68zfgrgik6vryxq";
+    };
+  }
+  {
+    goPackagePath = "github.com/namecoin/btcd";
+    fetch = {
+      type = "git";
+      url = "https://github.com/namecoin/btcd";
+      rev = "69a10543311fa68737d0a77b4cd045b0b0abfb75";
+      sha256 = "1zbfigs3hrjhdwp19877lpgivdcz3k80149nxdmxlmp03xcswcqy";
+    };
+  }
+  {
+    goPackagePath = "github.com/namecoin/ncbtcjson";
+    fetch = {
+      type = "git";
+      url = "https://github.com/namecoin/ncbtcjson";
+      rev = "fa221af062c70f802db6ed66e1546cc4a41ec277";
+      sha256 = "1fmz5aylsji27vj5f3f3gg9xj99735gh5prvcfz0gmk68v1mnr4i";
+    };
+  }
+  {
+    goPackagePath = "github.com/namecoin/ncrpcclient";
+    fetch = {
+      type = "git";
+      url = "https://github.com/namecoin/ncrpcclient";
+      rev = "858e1a5acd8b2da56462f50323633cdf2fe80977";
+      sha256 = "0pj951wm6fdkk2yv4bxaxka52i7rb6w3fs9ah3fy7p8wchr4smjx";
+    };
+  }
+  {
+    goPackagePath = "github.com/namecoin/tlsrestrictnss";
+    fetch = {
+      type = "git";
+      url = "https://github.com/namecoin/tlsrestrictnss";
+      rev = "945a9f3d995fcb175fd0b19549e21a3e87ba8c13";
+      sha256 = "18qphkqnjw3bwflkyyrddyzgwscs37j7y6ynm9g78bqb5skviqqy";
+    };
+  }
+  {
+    goPackagePath = "github.com/namecoin/x509-signature-splice";
+    fetch = {
+      type = "git";
+      url = "https://github.com/namecoin/x509-signature-splice";
+      rev = "d8b4bf2df701c55239a9fe82bb1e7bea10e30599";
+      sha256 = "0jlj4gb60s7b69d8yx6ljhxgvqgjz01n0h59fswblw09wfba8c4j";
+    };
+  }
+  {
+    goPackagePath = "github.com/ogier/pflag";
+    fetch = {
+      type = "git";
+      url = "https://github.com/ogier/pflag";
+      rev = "45c278ab3607870051a2ea9040bb85fcb8557481";
+      sha256 = "0620v75wppfd84d95n312wpngcb73cph4q3ivs1h0waljfnsrd5l";
+    };
+  }
+  {
+    goPackagePath = "github.com/shiena/ansicolor";
+    fetch = {
+      type = "git";
+      url = "https://github.com/shiena/ansicolor";
+      rev = "a422bbe96644373c5753384a59d678f7d261ff10";
+      sha256 = "1dcn8a9z6a5dxa2m3fkppnajcls8lanbl38qggkf646yi5qsk1hc";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/crypto";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/crypto";
+      rev = "279210d13fedf5be6d476bad5df6a015042bb905";
+      sha256 = "0syi72jba84nn1z89bqpcv94wjvzj71dwg1pj30xrcixcz1zsg26";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/net";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/net";
+      rev = "627f9648deb96c27737b83199d44bb5c1010cbcf";
+      sha256 = "0ziz7i9mhz6dy2f58dsa83flkk165w1cnazm7yksql5i9m7x099z";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/sys";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/sys";
+      rev = "6fdc65e7d9800cc59998e8ac0d9406a20ff5f399";
+      sha256 = "0al5gzij4qkrp11i1h8j7288pg6y716zyh2v0886pv2knha7gjvj";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/alecthomas/kingpin.v2";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/alecthomas/kingpin.v2";
+      rev = "947dcec5ba9c011838740e680966fd7087a71d0d";
+      sha256 = "0mndnv3hdngr3bxp7yxfd47cas4prv98sqw534mx7vp38gd88n5r";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/hlandau/configurable.v1";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/hlandau/configurable.v1";
+      rev = "41496864a1fe3e0fef2973f22372b755d2897402";
+      sha256 = "0i9jbdvi8rz12xsrzzbfxg5lwsqakjcmccsa5a32asmv26k5byqa";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/hlandau/easyconfig.v1";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/hlandau/easyconfig.v1";
+      rev = "c31249162931b4963bbe6e501cccb60d23271a3f";
+      sha256 = "1v8j1pyzcfj1l4pmb1c6mszci6xzc4agdam2kq79kyvbsvbbw9dc";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/hlandau/madns.v2";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/hlandau/madns.v2";
+      rev = "26979b3e4b5aa3e0bd53cf0a014f9eaf43b578e3";
+      sha256 = "09r4m4mqdgd7hvxyvss9m64lq0kk8nylnq2bgnkrclgzpi87fmmb";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/hlandau/service.v2";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/hlandau/service.v2";
+      rev = "b64b3467ebd16f64faec1640c25e318efc0c0d7b";
+      sha256 = "0lpx88f46ylx9lf6jgwcjgklll1pc1mlakrywpa0wzhjj7a4jinc";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/hlandau/svcutils.v1";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/hlandau/svcutils.v1";
+      rev = "c25dac49e50cbbcbef8c81b089f56156f4067729";
+      sha256 = "12b6p71mk33r44d71xizjq82fls0ykfwfl5gnmckbgpxms4bj2xf";
+    };
+  }
+]
diff --git a/nixpkgs/pkgs/servers/dns/ncdns/fix-tpl-path.patch b/nixpkgs/pkgs/servers/dns/ncdns/fix-tpl-path.patch
new file mode 100644
index 000000000000..850fb4d1b189
--- /dev/null
+++ b/nixpkgs/pkgs/servers/dns/ncdns/fix-tpl-path.patch
@@ -0,0 +1,27 @@
+This sets a default value for the tpl directory that works for Nixpkgs.
+
+diff --git a/server/web.go b/server/web.go
+index d024a42..0522d02 100644
+--- a/server/web.go
++++ b/server/web.go
+@@ -10,6 +10,7 @@ import "path/filepath"
+ import "time"
+ import "strings"
+ import "fmt"
++import "os"
+ 
+ var layoutTpl *template.Template
+ var mainPageTpl *template.Template
+@@ -44,7 +45,11 @@ func deriveTemplate(filename string) (*template.Template, error) {
+ }
+ 
+ func (s *Server) tplFilename(filename string) string {
+-	td := filepath.Join(s.cfg.ConfigDir, "..", "tpl")
++	ex, err := os.Executable()
++	if err != nil {
++		panic(err)
++	}
++	td := filepath.Join(filepath.Dir(ex), "..", "share", "tpl")
+ 	if s.cfg.TplPath != "" {
+ 		td = s.cfg.TplPath
+ 	}
diff --git a/nixpkgs/pkgs/servers/dns/nsd/default.nix b/nixpkgs/pkgs/servers/dns/nsd/default.nix
index 43c2900443e2..2dfdf108c4fa 100644
--- a/nixpkgs/pkgs/servers/dns/nsd/default.nix
+++ b/nixpkgs/pkgs/servers/dns/nsd/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, libevent, openssl
+{ stdenv, fetchurl, libevent, openssl, nixosTests
 , bind8Stats       ? false
 , checking         ? false
 , ipv6             ? true
@@ -11,16 +11,16 @@
 , rrtypes          ? false
 , zoneStats        ? false
 
-, configFile ? "etc/nsd/nsd.conf"
+, configFile ? "/etc/nsd/nsd.conf"
 }:
 
 stdenv.mkDerivation rec {
   pname = "nsd";
-  version = "4.3.1";
+  version = "4.3.2";
 
   src = fetchurl {
     url = "https://www.nlnetlabs.nl/downloads/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "11w9kl99fs888f3zwx2j92i8lcp78vq91jac8s317a2icv74mczl";
+    sha256 = "0ac3mbn5z4nc18782m9aswdpi2m9f4665vidw0ciyigdh0pywp2v";
   };
 
   prePatch = ''
@@ -52,6 +52,10 @@ stdenv.mkDerivation rec {
     sed 's@$(INSTALL_DATA) nsd.conf.sample $(DESTDIR)$(nsdconfigfile).sample@@g' -i Makefile.in
   '';
 
+  passthru.tests = {
+    inherit (nixosTests) nsd;
+  };
+
   meta = with stdenv.lib; {
     homepage = "http://www.nlnetlabs.nl";
     description = "Authoritative only, high performance, simple and open source name server";
diff --git a/nixpkgs/pkgs/servers/dns/pdns-recursor/default.nix b/nixpkgs/pkgs/servers/dns/pdns-recursor/default.nix
index 10a18ab1d458..051e619af4e4 100644
--- a/nixpkgs/pkgs/servers/dns/pdns-recursor/default.nix
+++ b/nixpkgs/pkgs/servers/dns/pdns-recursor/default.nix
@@ -8,11 +8,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "pdns-recursor";
-  version = "4.3.1";
+  version = "4.3.3";
 
   src = fetchurl {
     url = "https://downloads.powerdns.com/releases/pdns-recursor-${version}.tar.bz2";
-    sha256 = "1n9gymis0h1grgg63ig3kk9cb27ayy1w6s8hcn8n4g5dzi90h8sl";
+    sha256 = "020mx8mh6zrixkhsc2p1c2ccl9zfypay988jjxbk6ql020flig0b";
   };
 
   nativeBuildInputs = [ pkgconfig ];